CVE-2022-2184CWE-22CWE-352

CAPTCHA 4WP < 7.1.0 - Local File Inclusion via CSRF

published August 1, 2022

CVSS
—
EPSS
1%
Percentile
47.4
In the wild
Unconfirmed
What it is

The CAPTCHA 4WP WordPress plugin before 7.1.0 lets user input reach a sensitive require_once call in one of its admin-side templates. This can be abused by attackers, via a Cross-Site Request Forgery attack to run arbitrary code on the server.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00588 · 47.4th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2022-08-01T12:50Z
EPSS history
Timeline
  • 01 AUG 12:50Z
    CAPTCHA 4WP < 7.1.0 - Local File Inclusion via CSRF
    cvelistv5